JavaScript has long been the backbone of the interactive web, but its ubiquity has also made it the weapon of choice for attackers seeking to deliver drive-by downloads, credential stealers, and payload droppers. Now, a research team at Central South University in China has unveiled a new static detection technique that promises to strip away one of malware authors’ most effective defenses: obfuscation. The method, called JSCoherence, achieves an F1 score of 99.77 percent on public datasets and maintains more than 95 percent accuracy even when malicious scripts are scrambled by some of the most aggressive obfuscation tools available today. The work was published in the journal Cybersecurity.

The core problem the researchers set out to solve is deceptively simple to state but notoriously difficult to crack. Modern obfuscation techniques such as string splitting and concatenation, control-flow flattening, and dead-code injection do not merely hide code from human eyes. They actively destroy the contextual signals that detection systems rely on. Traditional static analyzers typically parse JavaScript into an abstract syntax tree, or AST, and then traverse the tree to build feature sequences capturing node types, values, and names. In unobfuscated code, this works well because statements carrying related semantics tend to sit adjacent to one another. A data-exfiltration script, for example, will initialize an XMLHttpRequest object and then immediately configure it with an open call, producing a tight, semantically coherent cluster of features that classifiers can easily flag.

Obfuscation shatters that coherence. By fragmenting key attack semantics across multiple scattered statements and burying them amid oceans of irrelevant, redundant syntax, obfuscators dilute the malicious signal until it disappears into the noise floor. The scale of the problem is striking: prior research cited in the study found that more than 89.4 percent of websites in the Alexa Top 10,000 contain at least one obfuscated script, meaning obfuscation alone cannot be treated as a marker of malice. Benign scripts use it too, to protect intellectual property. Detection methods must therefore distinguish malicious intent hidden by obfuscation from legitimate engineering practice protected by it.

The insight behind JSCoherence rests on a subtle observation about what obfuscation can and cannot do. While obfuscators rewrite program structure and disperse semantics across the syntax tree, they generally leave the program’s actual functionality intact. For complex malicious behavior to execute, the underlying data dependencies between variables must survive the transformation. A hidden URL parameter may be split into fragments, encoded, and reassembled at runtime, but the chain of variable assignments carrying those fragments remains traceable. The researchers realized that by following these variable-level data propagation relationships, they could reconnect statements that obfuscation had pulled apart and recover the locally coherent behavior that detection systems were missing.

Technically, the method centers on what the team calls data-dependent statement pairs, or DDSPs. A DDSP is any pair of statements in a program linked by a data dependency, meaning one statement produces or modifies a value that the other consumes. Using the open-access tool Js-transformations, which parses code with the Esprima parser and annotates variable nodes involved in data flows, JSCoherence identifies all such pairs in a script. Each statement is represented as a depth-first traversal sequence of AST node types and values within its smallest enclosing statement or declaration subtree. The resulting DDSP feature sequences effectively stitch together statements that may sit far apart in the raw AST but are semantically bound through shared variables, restoring a level of continuity that obfuscation cannot erase.

Of course, not all DDSPs are equally informative. Obfuscation injects enormous quantities of redundant statement pairs that carry no malicious semantics, and if these are fed to a classifier indiscriminately they degrade performance. JSCoherence addresses this through unsupervised clustering. Each DDSP is first embedded as a fixed-dimensional vector using FastText, a shallow text embedding model chosen for its efficiency and its ability to handle out-of-vocabulary words, which are abundant in obfuscated code full of mangled identifiers. K-Means clustering then groups semantically similar DDSPs, allowing low-information, highly repetitive pairs introduced by obfuscation to aggregate into stable but weakly discriminative clusters. Each script is then represented not by its raw features but by its distribution over these clusters, a length-k vector recording the proportion of its DDSPs falling into each cluster. This statistical footprint of variable-level operation patterns serves as the final feature representation.

For classification, the team deliberately chose a random forest rather than a deep neural network or a large language model. The random forest provides built-in feature importance estimation, which lets the system automatically down-weight redundant clusters during training while amplifying highly discriminative ones. It also confers a crucial practical advantage: interpretability. By examining the centroid DDSPs of the highest-importance clusters, analysts can see exactly which behavioral semantics drove a classification decision. In the study’s analysis, high-importance clusters in benign scripts captured ordinary patterns such as function definition and module export, conditional validation and branching, and standard require-and-invoke module usage. Malicious clusters, by contrast, revealed distinctly sinister behaviors: dynamic code construction via new Function followed by eval execution, recovery of encoded numeric values into hidden strings through String.fromCharCode, and binary payload writing to streams and disk via ADODB.Stream, a hallmark of downloaders and droppers.

The experimental evaluation was rigorous. Malicious samples were drawn from public repositories including Hynek Petrak’s JavaScript malware collection, Geeksonsecurity’s dataset, and MalwareBazaar, while benign samples came from scripts loaded by the top 10,000 websites in the Tranco ranking. To simulate modern threats, the researchers generated obfuscated variants using three popular tools of escalating sophistication: Jfogs, which applies lightweight wrapper-function obfuscation and zero-width character encoding; JSObfu, which randomizes code structure and rewrites string constants into runtime-evaluated expressions; and JavaScript-obfuscator, a comprehensive suite adding string arrayification, control-flow flattening, dead-code injection, and anti-analysis mechanisms such as self-defending and debug protection. Average script sizes ranged from 28 kilobytes in the original set to 283 kilobytes in the JavaScript-obfuscator set.

The results were decisive. Against strong static baselines including JSContana, JStrong, and JSRevealer, as well as a fine-tuned large language model approach built on a distilled DeepSeek-R1 model, JSCoherence consistently came out ahead. On the JSObfu and JavaScript-obfuscator datasets, the competing AST-based methods saw their metrics plummet by more than 19 percent and 13 percent respectively, while JSCoherence’s F1 score dropped by no more than 4.69 percent from its original-dataset performance. It outperformed the strongest static baseline by at least 4.68 percent in accuracy and exceeded the LLM-based methods by roughly 4 percent. The ablation studies confirmed that both components matter: DDSP extraction alone boosted F1 by up to 27.8 percent on heavily obfuscated datasets compared with raw AST sequences, and clustering added further gains of up to 8 percent on top of that.

Efficiency is another selling point. Average feature extraction takes roughly 0.04 seconds per script on unobfuscated code and 0.40 seconds even on the largest, most heavily obfuscated samples, while classification completes in under a millisecond. Training remains below 0.37 seconds per script. These figures dwarf the computational demands of deep learning and LLM-based alternatives, making the system feasible for client-side real-time attack detection, critical infrastructure protection, and large-scale web script analysis. The team also outlined an incremental cluster expansion strategy for million-scale corpora, in which new DDSPs are either assigned to existing cluster centers or buffered as outliers for periodic local reclustering, avoiding the prohibitive cost of global reclustering.

Cross-dataset generalization tests added further nuance. When trained only on lightly obfuscated Jfogs samples and tested on JavaScript-obfuscator variants, the model still achieved 85.75 percent accuracy, and training on the combined Jfogs and JSObfu sets raised that to 92.25 percent accuracy with an F1 of 91.42 percent. The trend demonstrates that data-dependent behavioral semantics are relatively stable across different obfuscation strategies, though a gap between cross-dataset and in-dataset performance shows that generalization across obfuscators remains an open challenge.

The authors are candid about limitations. Scripts whose malicious functionality lives entirely within a single statement fall outside the method’s design, though such patterns are often caught by conventional AST approaches, suggesting a cascaded deployment. Statically analyzing dynamically generated code, such as payloads assembled in loops and executed via eval, can only capture the external construction process rather than the decoded payload itself, though such patterns appear in 28.51 percent of malicious samples versus just 0.12 percent of benign ones, keeping false-positive risk low. The method also cannot see escape scripts that translate code into WebAssembly. As a future direction, the team proposes integrating dynamic execution tracing with static data-flow analysis to capture more complete behavior while preserving the speed of static detection. For now, JSCoherence offers security researchers a lightweight, explainable, and remarkably resilient new lens for seeing through the fog of obfuscated JavaScript.

Subject of Research: Detection of obfuscated malicious JavaScript using data-dependent statement pairs and static data-flow analysis

Subject of Research: Technology and Engineering

Article Title: JSCoherence: detecting obfuscated malicious JavaScript via data-dependent statement pairs

Article References: Chen, Z., Wang, W., Gu, Z., & Song, H. (2026). JSCoherence: detecting obfuscated malicious JavaScript via data-dependent statement pairs. Cybersecurity, 9(1), Article 212. https://doi.org/10.1186/s42400-026-00645-9

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00645-9

Keywords: malicious JavaScript, code obfuscation, static analysis, data-flow analysis, data-dependent statement pairs, machine learning, random forest, cybersecurity, abstract syntax tree, interpretability

Cite Scienmag News

APA
MLA
Chicago

Denise Maddox. (September 8, 2026). New method detects obfuscated malicious JavaScript through data-dependent statement pairs. Scienmag. https://scienmag.com/new-method-detects-obfuscated-malicious-javascript-through-data-dependent-statement-pairs/

Copy citation
Download RIS

Tags: AST-based static analysis challengescode obfuscation techniques in cybersecuritycontrol-flow obfuscation countermeasurescybersecurity research on JavaScriptdata-dependent statement pair analysisdata-dependent statement pairs in JavaScripthandling control-flow flattening and dead-code injectionhigh-accuracy JavaScript malware detectionhigh-accuracy malware detection in JavaScriptJavaScript code analysis for cybersecurityJavaScript malware detectionJavaScript malware detection methodsJSCoherence malware detection methodmachine learning in cybersecuritymachine learning in cybersecurity for JavaScriptmalware detection in interactive web applicationsobfuscation-resistant malware detectionobfuscation-resistant static analysisovercoming JavaScript code obfuscationrobustness of static analyzers against obfuscationstatic analysis of obfuscated JavaScriptstatic analysis techniques for malicious JavaScriptstatic code analysis for malicious scripts